Anjouan Gaming Licence AML Requirements Explained 2026

Anjouan gaming licence AML requirements are the anti-money laundering and counter-terrorist financing controls the Anjouan Gaming Commission expects a licensee to run. They cover a written AML policy, a Money Laundering Reporting Officer, customer due diligence, transaction monitoring, sanctions screening, and record-keeping. This guide works through each control and the points where a file most often stalls in review. It also flags the items you should confirm with the Commission in writing rather than assume. For the full licence overview, start with our Anjouan gaming licence page.

What Anjouan gaming licence AML requirements cover

Anjouan gaming licence AML requirements run across six areas: policy, people, customers, transactions, screening, and records. The Commission reviews your controls before it grants the authorisation. Then it checks them again once the licence is live, because the licence renews every year and the gap between reviews stays short.

The controls are not a filing exercise. They shape how you onboard players, how you clear withdrawals, and how you flag risk day to day. So a policy that reads well but does not match your live platform tends to draw questions at the first review.

Most operators treat AML as a document to attach at application. In practice it is an operating function you staff and run for as long as you hold the licence. The sections below set out each requirement and the standard behind it. They also flag what the Commission has not published, so you know what to pin down before launch.

Legal basis for Anjouan gaming licence AML requirements

Anjouan is an autonomous island of the Union of the Comoros, so its gaming rules do not sit on their own. Comorian anti-money laundering and counter-terrorist financing law applies to companies licensed on Anjouan, on top of the conditions the Commission sets at licensing. So an applicant builds an AML policy against both layers rather than the island framework alone.

Above both sits the international benchmark. The Commission expects your controls to match the FATF Recommendations, because banks and payment providers assess your file against the same standard. That means the expectations on an Anjouan licensee track international practice rather than a light local rulebook. The Comoros has also been through an international AML and CFT assessment, so the direction of travel is toward the FATF benchmark.

The Commission also runs fit-and-proper due diligence on every director, shareholder, and ultimate beneficial owner. It screens each person against sanctions and PEP lists. You can confirm the regulator and its oversight structure on the official Anjouan Gaming Commission site, which operates under the Anjouan Offshore Financial Authority. For the wider document and eligibility set that sits alongside these checks, see our guide to Anjouan gaming licence requirements.

Your written AML policy and business risk assessment

Every Anjouan licensee needs a written AML and CFT policy, and the Commission reviews it as part of the gaming file. The policy must cover customer identification, source of funds, transaction monitoring, suspicious activity reporting, record retention, and staff training. A generic template that names no payment methods, markets, or thresholds reads as untested, so build it around your actual operation.

Underneath the policy sits a business risk assessment. This is the document that justifies your thresholds and your controls. It maps your player markets, your products, and your payment rails to a money-laundering risk rating, then sets the checks that follow. First you assess the risk, then you set the control. That order is what a reviewer looks for.

Where you have no in-house capacity to draft and maintain these documents, our gaming licensing compliance team prepares them and keeps them current. Keep the policy and the risk assessment as living files, because the Commission can ask to see both during a compliance check.

The Money Laundering Reporting Officer and compliance function

A compliance officer is mandatory for an Anjouan licence, and that person is authorised as a Key Person by the Commission. In practice the role is the Money Laundering Reporting Officer. The MLRO owns the AML function. They set the thresholds, review internal alerts, decide when to file a suspicious activity report, and act as the contact point for the regulator. This is a named role, not a title you spread across a team.

The initial submission is usually light. Operators typically supply the officer’s name and contact details, and the Commission grants Key Person Authorisation for the appointment. Even so, the role carries real weight after licensing, so appoint someone who can actually run it. Many operators use an outsourced compliance officer, because the Commission does not publish a requirement for the MLRO to reside on Anjouan.

Two points are worth confirming in writing. First, whether the Commission expects the MLRO to hold a formal AML qualification such as ACAMS or ICA. Second, whether it runs a background check on the officer before it grants Key Person status. Neither is published in detail, so ask rather than assume. Where you need the function supplied and kept active, our MLRO and compliance officer provision covers it.

KYC and customer due diligence for Anjouan licensees

Know-your-customer checks sit at the front of your AML controls, and the Anjouan gaming licence KYC requirements follow standard international practice. You verify a player’s identity with government ID and proof of address. Operators commonly run that check before the first payout and once a player’s cumulative deposits pass USD 10,000.

That threshold is a common market figure rather than a number the Commission publishes as a hard rule. So you set your own trigger in the policy and justify it against your risk assessment. Enhanced due diligence applies to higher-risk cases: large deposits, unusual patterns, or a player who turns out to be politically exposed. In those cases you ask for source of funds, and for source of wealth where the amounts warrant it.

Get one point confirmed before launch. The Commission has not published fixed monetary thresholds that trigger CDD or a source-of-funds request. It also has not said whether full verification must run before the first deposit or only before the first payout. So agree acceptable levels with the regulator and record them. A documented, risk-based approach is what a review rewards, and it is also what payment providers ask to see during onboarding.

Transaction monitoring under Anjouan gaming licence AML requirements

You must monitor player transactions and report suspicious activity. Monitoring means a system that flags risk patterns. Examples include rapid deposit and withdrawal with little play, structured deposits below a threshold, or funds that do not match a player’s profile. The MLRO reviews the alerts and decides which ones escalate.

When an alert becomes a genuine suspicion, the MLRO files a suspicious activity report with the relevant financial intelligence authority. Here the Commission leaves detail open. It has not published which body receives reports: the Anjouan Offshore Financial Authority, a central Comoros financial intelligence unit, or another. It also sets no fixed filing deadline such as 24 hours or three business days. So confirm the reporting route and the timeframe with the Commission in writing at licensing, and record both in your policy.

Keep the monitoring evidence. The Commission can ask for transaction logs and the alerts your system raised during a compliance check. So the point of monitoring is to show the work, not just to run software in the background.

Sanctions and PEP screening at onboarding

Sanctions and politically exposed person screening is part of every Anjouan licensee’s AML controls. You screen players against sanctions lists and PEP databases, and you geo-block Comoros residents and restricted jurisdictions as a licence condition. The Commission already screens your owners and directors at pre-approval, and it expects you to screen players on the same basis.

One open question is timing. The Commission does not state whether screening must run in real time at registration or only before a deposit or withdrawal. Real-time screening at registration is the stronger position, and it is what most payment partners expect. So default to screening at sign-up and confirm the minimum with the regulator.

The Commission also publishes no approved list of KYC or screening vendors. That means you may use an established provider or an in-house engine, as long as the control works and you can evidence it. Whatever you choose, document how a PEP match escalates to enhanced due diligence. Also set a screening frequency that rescreens the book against updated lists, rather than at sign-up alone.

AML controls for crypto deposits

Crypto payments sit inside the same Anjouan licence, so the AML rules apply to them in full. Crypto changes how you meet the rules, not whether you meet them. Funds arrive without an intermediary bank running its own checks, so your controls carry more of the load.

Screen deposit wallets with blockchain analytics before you credit funds, and treat unhosted wallet transfers as higher risk. Where you process virtual assets, the FATF Travel Rule applies to transfers above USD 1,000, which means collecting and passing originator and beneficiary information. Ask the Commission whether it enforces the Travel Rule directly and whether it expects crypto KYC at a lower threshold than fiat. The common USD 10,000 practice was written with card and bank deposits in mind.

Set crypto source-of-funds triggers in your policy and justify them. For how digital assets sit inside the licence more broadly, see our guide to the Anjouan crypto gaming licence. Confirm your wallet-screening approach with the regulator rather than assume analytics alone is enough.

Record-keeping, retention and independent AML audits

You keep KYC files, transaction records, and monitoring alerts available for the Commission to inspect on request. The FATF Recommendations set a minimum retention period of five years after a transaction or the end of a business relationship. Anjouan has not published its own figure, so treat five years as the floor and confirm the exact period with the Commission.

Retention also interacts with data protection. If you serve players in markets covered by the EU GDPR, a player can ask you to delete their data. Your AML obligation still requires you to keep it. In most cases the AML retention duty takes priority for the records the law requires. Still, confirm how you reconcile the two in your privacy policy.

The Commission reviews the material a licensee submits and can run checks after the licence is live. So an internal self-assessment by the MLRO may not be enough on its own. Confirm whether the Commission requires an independent external AML audit, and which standard it applies at renewal. Ask early, because the risk-based template it evaluates against is not published.

Where Anjouan gaming licence AML requirements trip operators up

AML files stall for a short list of reasons, and most are avoidable with preparation. The pattern repeats across offshore applications.

1. A generic AML manual. Templates that name no markets, payment methods, or thresholds read as untested and draw questions.
2. A source-of-wealth trail that stops at a bank balance. The Commission wants a documented trail showing how the wealth was built and how the funds reached the company.
3. An MLRO in name only. Appointing someone who does not run the function leaves alerts unreviewed and reports unfiled.
4. No business risk assessment. Thresholds set with no risk rating behind them are hard to justify at review.
5. A plan that does not geo-block the Comoros. The licence does not permit local play, so a platform that cannot block Comorian players fails a core condition.

Documents also expire. Personal records such as passports, utility bills and reference letters are commonly accepted only when dated within 90 days. So a slow file can force you to collect them again.

Renewals fail for a narrower set of reasons: lapsed monitoring, records that cannot be produced on request, and a missed audit. Because the licence is annual, a lapse surfaces quickly. Building the corporate base early helps too, which is where our gaming company incorporation service sets the structure up front.

What the licence and its AML rules do not cover

Meeting your Anjouan gaming licence AML requirements keeps you compliant with the Commission. It does not make you compliant everywhere you take bets. The licence has clear territorial limits, and you plan around them from launch.

• The European Union, United Kingdom, United States, and Australia run their own regimes and require a local licence. Several EU states, including France, Germany, Spain, the Netherlands and Austria, sit on the standard restricted list.
• You geo-block residents of the Comoros, including Anjouan itself, as a condition of the licence.
• Advertising and bonus rules come from the national regulator of each market you promote in, not from the Commission.

Within those limits, the licence opens markets across Latin America, Africa, parts of Asia, and Eastern Europe under a single authorisation. Most single-jurisdiction offshore licences follow the same pattern, as covered in our Mwali gaming licence guide. Knowing the scope sets your geo-blocking rules and your market map before you build.

Frequently asked questions

What AML requirements apply to an Anjouan gaming licence?

An Anjouan licensee must hold a written AML and CFT policy and appoint a compliance officer who runs the AML function. It must also run KYC, transaction monitoring, sanctions screening, and record-keeping. The Commission expects these controls to match the FATF Recommendations, on top of Comorian AML law. It reviews them at application and again after the licence is live.

Does an Anjouan licence require a Money Laundering Reporting Officer?

Yes. The Commission requires a compliance officer, authorised as a Key Person, and in practice that person acts as the MLRO. That officer owns the AML function, from setting thresholds to filing suspicious activity reports. The Commission does not publish a residency rule, so the person can be an outsourced compliance officer based outside Anjouan.

When must an Anjouan licensee verify a player?

Operators commonly verify identity before the first payout and once a player’s cumulative deposits pass USD 10,000. That figure reflects standard market practice rather than a threshold the Commission publishes. Set your own risk-based triggers in the policy, and confirm with the regulator whether it expects full verification before the first deposit.

How do the AML rules apply to crypto deposits?

The same AML obligations cover crypto and fiat, but crypto shifts more of the load onto your controls. Screen deposit wallets with blockchain analytics and treat unhosted wallets as higher risk. Apply the FATF Travel Rule to virtual asset transfers above USD 1,000. Confirm with the Commission whether it expects a lower KYC threshold for crypto than for card and bank deposits.

Who receives suspicious activity reports from an Anjouan operator?

The MLRO files reports with the relevant financial intelligence authority. The Commission has not published which body receives them: the Anjouan Offshore Financial Authority, a central Comoros unit, or another. It has also set no fixed filing deadline. Agree the reporting route and the timeframe with the Commission in writing at licensing, and record both in your policy.

How long must an Anjouan licensee keep AML records?

The FATF minimum is five years after a transaction or the end of a business relationship, and Anjouan has not published a longer period. Keep KYC files, transaction logs, and monitoring records available for the Commission to inspect. Confirm the exact retention period before you finalise your policy.

Does an Anjouan licence require an independent AML audit?

The Commission reviews the material a licensee submits and can check controls after licensing. So an internal review by the MLRO alone may not be sufficient. Whether it requires a formal independent external audit, and the standard it applies at renewal, is not published. Confirm both with the regulator so your file matches what it checks.

Can a small operator outsource its AML function?

Yes. Many operators appoint an external MLRO and use a compliance provider to draft the policy and run monitoring. The function still has to be real and active, because the Commission reviews it at renewal and can check it during the licence term. Outsourcing the role does not remove the obligation to evidence the controls.

Several Anjouan gaming licence AML requirements sit outside published guidance. These include the CDD and source-of-funds thresholds, the suspicious activity reporting route and deadline, the retention period, and the audit standard. Confirm each one with the Commission in writing at licensing rather than after a breach. DD Consultus handles Anjouan applications, MLRO appointments, and ongoing AML compliance. To review your file, call +356 99408536 or email contact@licencegaming.com.